feat(cli): include workspace package.json files in code bundle cache hash

[sorccu]

Summary

• Extends the playwright code bundle cache hash to cover every workspace package.json (root + member packages) in addition to the lockfile, with the top-level version field stripped so CI-driven version bumps don't invalidate the cache.
• New cache-hash.ts module exposes a stable JSON encoder (sorted keys, HTML-significant + line/paragraph separators escaped), a package.json canonicalizer, and composeCacheHash which combines records using length-prefixed lockfile:<basename> and package.json:<rel/path> blocks (8-byte BE length + label, 8-byte BE length + content).
• The byte layout mirrors composeBundleChecksum in terraform-provider-checkly (#364) so identical inputs produce identical SHA-256 digests in both codebases. A hard-coded fixture digest is asserted in tests; mirror it into the TF provider test suite to lock in cross-language parity.

Linear: SIM-227

Test plan

• Existing check-parser unit tests pass (npx vitest run src/services/check-parser/).
• New cache-hash.spec.ts covers: stable encoder behavior, version-stripping canonicalization, source key reordering, lockfile change sensitivity, workspace-member addition, input order independence, and a fixed parity fixture digest.
• Mirror the parity fixture into terraform-provider-checkly tests and confirm both sides produce 4d3072de5db2f0f8a5e29b72013dd7e4dfb25686023931ee98050d58ba4503f8.
• Sanity-check a real playwright deploy: bundle hash should be stable across reruns when only version changes; a dependency edit in any workspace package.json should change the hash.

🤖 Generated with Claude Code